Five steps to audit-proof your IT

infrastructure
By Jonathan Wolf, Gold Wire Technology Inc.
May 13, 2004 12:00 PM ET
inShare

Computerworld - The word audit usually makes security and IT staffs either groan or quake with
fear. Failing an audit is everyone's worst nightmare because of the potential damage to the
organization's reputation and its ability to transact business.
Yet with the increasing importance of regulations and standards such as Sarbanes-Oxley, ISO
17799 and Visa's Cardholder Information Security Program (CISP), the number of audits is
increasing. Also increasing is the time it takes to perform the audit and the cost to the
organization. Companies are being told by regulators to control key IT information processes and
to clearly demonstrate such control through rigorous systems and audits.
A critical element in passing audits is demonstrating control over network and security staffs.
However, this requirement remains largely ignored. A Yankee Group survey showed that 70% of
companies use shared password access control techniques somewhere in their infrastructure, an
inherently insecure situation given that there's no direct accountability and little way to prevent
passwords from falling into the wrong hands. Further, the survey found that 58% of large
retailers used access control techniques that wouldn't pass Visa's CISP standards. Several
organizations are known to have failed industry-mandated audits recently because they lacked
operator access controls over device and server settings.
When auditors ask IT staffs, "Who's guarding the guards?" the answer "The guards themselves"
clearly isn't good enough.
Manual approach has limits
Beyond the issue of simple access control, there's the question of the basic correctness of the
security systems deployed, including router access control lists, firewall rules and server
privilege settings. For most organizations, demonstrating that these settings are correct usually
involves tedious configuration audits performed manually every few months. One major retailer
recently estimated that its quarterly audit of device access control settings required the work of
two operators for three days each, or a total of six days of their time.
Manual audit reporting also raises a question of ongoing governance. If an event occurs between
audits, will it be detected or will it leave the organization exposed until the next audit cycle? If
operators leave the organization or a personnel matter arises, are there facilities in place to
demonstrate an audit trail as required? Does each new audit request mean yet another one-time
expenditure?
Five key steps in audit-proofing your infrastructure
Of the many steps required to comply with an audit, the following five in particular are often
overlooked. They represent great ways to help audit-proof the infrastructure as well as increase
overall IT quality.

1. Enforce operator access control standards with a flexible and granular permissions model
for role-based access control to all network devices and servers. If there is an
 unauthorized attempt to gain access to the network infrastructure, security and IT staff
should be able to detect it and alert the appropriate personnel. The same access controls
may be required for technology service providers or outsourcers. Watch out for weak
areas where you may have administrative passwords that are shared by multiple
operators. These commonly arise in securing Unix servers and network devices,
particularly legacy gear that doesn't easily support a central authentication server.
2. Keep an activity trail with real-time auditing, including a who, what, where and when of
all operator activity and infrastructure changes, especially those that could be
inappropriate or malicious. Making IT staff responsible for reporting their own activity
won't cut it.
3. Demonstrate a strong change management process by being able to confirm that
infrastructure changes go as planned with a real-time, live-network change review.
4. Automatically verify compliance with both external best practices and internal standards.
When IT staff members change critical server or network device settings, managers must
be able to ensure that they comply with industry best practices and organizational
standards. Instead of yearly manual audits, IT staffs should be able to perform daily
checks across their infrastructure so they can show they are looking for configuration
settings that violate security policy.
5. Make available on-demand historical reports that security and IT staff members, as well
as auditors, can view upon request to demonstrate that controls and standards have been
continuously enforced. The more easily IT can generate these reports, and the less that
human input is required to collect the data, the more reliable the results typically will be
in the eyes of an auditor.